CVE-2026-105934

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

EUVD-2026-107471

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

CVE-2026-105934 Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

CVE-2026-105934

The Apache Pulsar broker admin REST API contains a missing authorization check (CWE-862) when truncating partitioned topics via the DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate endpoint. While non-partitioned topics require tenant admin or superuser roles, the broker fails to...

Linux Distros Unpatched Vulnerability : CVE-2026-112909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local...

DEBIAN-CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

EUVD-2026-102205

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Do not hold the nilock lock when calling truncatesetsize. syzbot reports a hung task during the call to douseraddrfault 1. This occurs because there is a silent deadlock between the PGlocked bit and the nilock lock. Sin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Convert inline data to extents when truncate exceeds inline size A check has been added to ext4setattr to convert files from inline data storage to extent-based storage when the truncate function increases the file size...

CVE-2026-110458

The UniFi Protect AI Key is vulnerable to a Path Traversal vulnerability (CWE-22) that could be exploited by a malicious actor with network access. Under specific conditions, this flaw allows an attacker to create or truncate files on the device. No specific remediation or exploit details are pro...

ogmios-queryledgerstate-dump-poc

Ogmios queryLedgerState/dump — Unauthenticated Arbitrary Fil...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4184)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4093)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP11 : python-filelock (EulerOS-SA-2026-4366)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

CVE-2026-108839: Improper Link Resolution Before File Access

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: block: Fixed an incorrect offset in biotruncate The biotruncate function clears the buffer outside of the last block of bdev. However, the current implementation of biotruncate uses the wrong offset for the page. As a result, it...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the chars and words methods from django.utils.text.Truncator when used with html=True are susceptible to a potential DoS denial of service attack due to certain inputs containing very long, potentially malformed HTML text. The...

MGASA-2026-0462 Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...